Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00bb6ae5 authored by Paul Mackerras's avatar Paul Mackerras
Browse files

KVM: PPC: Book3S HV: Don't call real-mode XICS hypercall handlers if not enabled 



When running a guest on a POWER9 system with the in-kernel XICS
emulation disabled (for example by running QEMU with the parameter
"-machine pseries,kernel_irqchip=off"), the kernel does not pass
the XICS-related hypercalls such as H_CPPR up to userspace for
emulation there as it should.

The reason for this is that the real-mode handlers for these
hypercalls don't check whether a XICS device has been instantiated
before calling the xics-on-xive code.  That code doesn't check
either, leading to potential NULL pointer dereferences because
vcpu->arch.xive_vcpu is NULL.  Those dereferences won't cause an
exception in real mode but will lead to kernel memory corruption.

This fixes it by adding kvmppc_xics_enabled() checks before calling
the XICS functions.

Cc: stable@vger.kernel.org # v4.11+
Fixes: 5af50993 ("KVM: PPC: Book3S HV: Native usage of the XIVE interrupt controller")
Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
parent 891f1ebf

arch/powerpc/kvm/book3s_hv_builtin.c

+12 −0
Original line number Original line Diff line number Diff line
@@ -529,6 +529,8 @@ static inline bool is_rm(void) 




unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)

unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())

			return xive_rm_h_xirr(vcpu);

			return xive_rm_h_xirr(vcpu);
@@ -541,6 +543,8 @@ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu) 




unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)

unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	vcpu->arch.gpr[5] = get_tb();

	vcpu->arch.gpr[5] = get_tb();

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())
@@ -554,6 +558,8 @@ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu) 




unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)

unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())

			return xive_rm_h_ipoll(vcpu, server);

			return xive_rm_h_ipoll(vcpu, server);
@@ -567,6 +573,8 @@ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server) 
int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,

int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,

		    unsigned long mfrr)

		    unsigned long mfrr)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())

			return xive_rm_h_ipi(vcpu, server, mfrr);

			return xive_rm_h_ipi(vcpu, server, mfrr);
@@ -579,6 +587,8 @@ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server, 




int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)

int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())

			return xive_rm_h_cppr(vcpu, cppr);

			return xive_rm_h_cppr(vcpu, cppr);
@@ -591,6 +601,8 @@ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr) 




int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)

int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)

{

{

	if (!kvmppc_xics_enabled(vcpu))

		return H_TOO_HARD;

	if (xive_enabled()) {

	if (xive_enabled()) {

		if (is_rm())

		if (is_rm())

			return xive_rm_h_eoi(vcpu, xirr);

			return xive_rm_h_eoi(vcpu, xirr);